@telorun/kernel 0.42.0 → 0.43.0

package/dist/manifest-sources/local-manifest-cache-source.js

@@ -1,15 +1,12 @@
 import { splitIntegrity, verifyIntegrity } from "@telorun/analyzer";
-import { createHash } from "crypto";
 import { statSync } from "fs";
 import * as fs from "fs/promises";
 import * as path from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 import { hostEnv } from "../host-env.js";
+import { defaultTransportRegistry } from "../transports/transport-registry.js";
 const CACHE_SUBDIR = ".telo/manifests";
-const HTTP_NAMESPACE = "__http";
-const DEFAULT_MANIFEST_FILENAME = "telo.yaml";
 const DEFAULT_REGISTRY_URL = "https://registry.telo.run";
-const QUERY_HASH_LENGTH = 12;
 /** Verify that `candidate` resolves to a path under `root`. Returns the
  *  candidate path on success, `null` when any segment escapes the root.
  *  Guards against `..` segments inside module refs or HTTP pathnames. */
@@ -24,95 +21,19 @@ function joinUnder(root, ...segments) {
     }
     return candidate;
 }
-/** Mirror `HttpSource.read`'s `fetchUrl` derivation: when the URL does not
- *  already point at a YAML file, append `/telo.yaml`. Used by both the
- *  reader and writer so a raw import URL and the canonical source it
- *  resolves to map to the same cache path. */
-function normalizePathname(url, parsed) {
-    let pathname = parsed.pathname;
-    if (!url.includes(".yaml")) {
-        pathname = pathname.endsWith("/")
-            ? `${pathname}${DEFAULT_MANIFEST_FILENAME}`
-            : `${pathname}/${DEFAULT_MANIFEST_FILENAME}`;
-    }
-    return pathname;
-}
-/** Compute a short hash of `search + hash` so two URLs that differ only in
- *  query / fragment do not collide at the same cache path. Inserted before
- *  the final extension so the filename stays readable. */
-function disambiguatePath(pathname, search, hash) {
-    if (!search && !hash)
-        return pathname;
-    const digest = createHash("sha256")
-        .update(search + hash)
-        .digest("hex")
-        .slice(0, QUERY_HASH_LENGTH);
-    const ext = path.extname(pathname);
-    const base = pathname.slice(0, pathname.length - ext.length);
-    return `${base}.${digest}${ext}`;
-}
 /** Single source of truth for URL → cache path. Used identically by the
  *  reader (cache lookup) and writer (install-time persistence). For any
- *  given import URL — registry ref, direct registry URL, or arbitrary
- *  HTTP — both sides land on the same file.
+ *  given import ref — registry ref, direct registry URL, arbitrary HTTP, or
+ *  (once registered) `oci://` — both sides land on the same file, because the
+ *  owning transport decides the layout via {@link Transport.cacheLocation}.
  *
- *  Returns `null` for unsupported URLs (file://, memory://, relative paths)
- *  or for path-traversal attempts that would escape `cacheRoot`. */
-function cachePathForUrl(rawUrl, cacheRoot, registryUrl) {
-    // Strip any inline integrity fragment so the cache path is derived from the
-    // bare ref/URL — the hash never participates in on-disk keying.
-    const url = splitIntegrity(rawUrl).base;
-    const trimmedRegistry = registryUrl.replace(/\/+$/, "");
-    // 1. Registry ref form: namespace/name@version
-    if (!url.startsWith("http://") &&
-        !url.startsWith("https://") &&
-        !url.startsWith("/") &&
-        !url.startsWith(".") &&
-        !url.startsWith("file://") &&
-        !url.startsWith("memory://") &&
-        url.includes("@") &&
-        url.includes("/")) {
-        const atIdx = url.lastIndexOf("@");
-        if (atIdx <= 0 || atIdx === url.length - 1)
-            return null;
-        const modulePath = url.slice(0, atIdx);
-        if (!modulePath.includes("/"))
-            return null;
-        const version = url.slice(atIdx + 1).replace(/^v/, "");
-        if (!version)
-            return null;
-        return joinUnder(cacheRoot, modulePath, version, DEFAULT_MANIFEST_FILENAME);
-    }
-    // 2. HTTP(S) URL — could be a direct registry URL or arbitrary external.
-    if (url.startsWith("http://") || url.startsWith("https://")) {
-        let parsed;
-        try {
-            parsed = new URL(url);
-        }
-        catch {
-            return null;
-        }
-        const pathname = normalizePathname(url, parsed);
-        // 2a. URL is on the configured registry, with no query/fragment:
-        //     fold into the registry layout so the writer that received a
-        //     registry-ref canonical and the reader that sees a direct URL
-        //     both resolve to the same file.
-        const normalizedUrl = `${parsed.protocol}//${parsed.host}${pathname}`;
-        if (!parsed.search &&
-            !parsed.hash &&
-            (normalizedUrl === trimmedRegistry || normalizedUrl.startsWith(`${trimmedRegistry}/`))) {
-            const rel = normalizedUrl.slice(trimmedRegistry.length + 1);
-            if (!rel)
-                return null;
-            return joinUnder(cacheRoot, ...rel.split("/"));
-        }
-        // 2b. Arbitrary HTTP(S) URL → __http subtree, with a short query-hash
-        //     suffix when query / fragment are present to prevent collisions.
-        const cleanPath = pathname.startsWith("/") ? pathname.slice(1) : pathname;
-        const disambiguated = disambiguatePath(cleanPath, parsed.search, parsed.hash);
-        return joinUnder(cacheRoot, HTTP_NAMESPACE, parsed.host, ...disambiguated.split("/"));
-    }
-    return null;
+ *  Returns `null` for unsupported refs (file://, memory://, relative paths) or
+ *  for path-traversal attempts that would escape `cacheRoot`. */
+function cachePathForUrl(rawUrl, cacheRoot, transports) {
+    const segments = transports.cacheLocation(rawUrl);
+    if (!segments)
+        return null;
+    return joinUnder(cacheRoot, ...segments);
 }
 /**
  * Reads previously-cached manifest YAMLs from `<entry-dir>/.telo/manifests/`.
@@ -127,7 +48,7 @@ export class LocalManifestCacheSource {
         // single `resolveCacheRoot` (honours `TELO_CACHE_DIR`); when absent we fall
         // back to the entry-anchored default so library/test callers are unchanged.
         this.cacheRoot = manifestsDir ?? path.join(entryDir, CACHE_SUBDIR);
-        this.registryUrl = registryUrl;
+        this.transports = defaultTransportRegistry(registryUrl);
     }
     supports(url) {
         return this.tryMap(url) !== null;
@@ -158,7 +79,7 @@ export class LocalManifestCacheSource {
         return new URL(relative, baseDir).href;
     }
     tryMap(url) {
-        const candidate = cachePathForUrl(url, this.cacheRoot, this.registryUrl);
+        const candidate = cachePathForUrl(url, this.cacheRoot, this.transports);
         if (!candidate)
             return null;
         // Require a regular file. A directory, dangling symlink, or stat failure
@@ -183,7 +104,7 @@ export class LocalManifestCacheSource {
  */
 export function cachePathForCanonical(canonicalSource, entryDir, registryUrl, manifestsDir) {
     const cacheRoot = manifestsDir ?? path.join(entryDir, CACHE_SUBDIR);
-    return cachePathForUrl(canonicalSource, cacheRoot, registryUrl);
+    return cachePathForUrl(canonicalSource, cacheRoot, defaultTransportRegistry(registryUrl));
 }
 /**
  * Persist every manifest file reachable from `graph` (owners + partials) to

package/dist/manifest-sources/local-manifest-cache-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-manifest-cache-source.js","sourceRoot":"","sources":["../../src/manifest-sources/local-manifest-cache-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAyC,MAAM,mBAAmB,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAC9C,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AACzD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;yEAEyE;AACzE,SAAS,SAAS,CAAC,IAAY,EAAE,GAAG,QAAkB;IACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;8CAG8C;AAC9C,SAAS,iBAAiB,CAAC,GAAW,EAAE,MAAW;IACjD,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC/B,CAAC,CAAC,GAAG,QAAQ,GAAG,yBAAyB,EAAE;YAC3C,CAAC,CAAC,GAAG,QAAQ,IAAI,yBAAyB,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;0DAE0D;AAC1D,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY;IACtE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,GAAG,IAAI,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;oEAMoE;AACpE,SAAS,eAAe,CACtB,MAAc,EACd,SAAiB,EACjB,WAAmB;IAEnB,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IACxC,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAExD,+CAA+C;IAC/C,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1B,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAC3B,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QACpB,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QACpB,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1B,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EACjB,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAC9E,CAAC;IAED,yEAAyE;IACzE,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEhD,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,qCAAqC;QACrC,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QACtE,IACE,CAAC,MAAM,CAAC,MAAM;YACd,CAAC,MAAM,CAAC,IAAI;YACZ,CAAC,aAAa,KAAK,eAAe,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,eAAe,GAAG,CAAC,CAAC,EACtF,CAAC;YACD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO,SAAS,CAAC,SAAS,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAInC,YACE,QAAgB,EAChB,cAAsB,oBAAoB,EAC1C,YAAqB;QAErB,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,CAAC,SAAS,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,sCAAsC,CACxF,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YAClF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IAED,eAAe,CAAC,IAAY,EAAE,QAAgB;QAC5C,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAuB,EACvB,QAAgB,EAChB,WAAmB,EACnB,YAAqB;IAErB,MAAM,SAAS,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpE,OAAO,eAAe,CAAC,eAAe,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAkB,EAClB,QAAgB,EAChB,cAAsB,oBAAoB,EAC1C,YAAqB;IAErB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU;gBAAE,SAAS;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEtB,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM;gBAAE,SAAS;YAEtB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;iFAIiF;AACjF,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;cAQc;AACd,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,cAAc,CAAC;IAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}
+{"version":3,"file":"local-manifest-cache-source.js","sourceRoot":"","sources":["../../src/manifest-sources/local-manifest-cache-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAyC,MAAM,mBAAmB,CAAC;AAC3G,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAqB,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAElG,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEzD;;yEAEyE;AACzE,SAAS,SAAS,CAAC,IAAY,EAAE,GAAG,QAAkB;IACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;iEAOiE;AACjE,SAAS,eAAe,CACtB,MAAc,EACd,SAAiB,EACjB,UAA6B;IAE7B,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,SAAS,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAInC,YACE,QAAgB,EAChB,cAAsB,oBAAoB,EAC1C,YAAqB;QAErB,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,CAAC,SAAS,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,sCAAsC,CACxF,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YAClF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IAED,eAAe,CAAC,IAAY,EAAE,QAAgB;QAC5C,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAuB,EACvB,QAAgB,EAChB,WAAmB,EACnB,YAAqB;IAErB,MAAM,SAAS,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpE,OAAO,eAAe,CAAC,eAAe,EAAE,SAAS,EAAE,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAkB,EAClB,QAAgB,EAChB,cAAsB,oBAAoB,EAC1C,YAAqB;IAErB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU;gBAAE,SAAS;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEtB,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM;gBAAE,SAAS;YAEtB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;iFAIiF;AACjF,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;cAQc;AACd,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,cAAc,CAAC;IAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/dist/transports/oci/docker-credentials.d.ts

@@ -0,0 +1,10 @@
+export interface DockerCredential {
+    username: string;
+    password: string;
+}
+/** Resolve credentials for `host` from the ambient Docker credential chain:
+ *  a per-registry credential helper, the global credential store, then the
+ *  inline `auths` entry (base64 `user:password` or explicit fields). Returns
+ *  null for anonymous access — the caller falls back to an anonymous token. */
+export declare function resolveDockerCredential(host: string): Promise<DockerCredential | null>;
+//# sourceMappingURL=docker-credentials.d.ts.map

package/dist/transports/oci/docker-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-credentials.d.ts","sourceRoot":"","sources":["../../../src/transports/oci/docker-credentials.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkDD;;;+EAG+E;AAC/E,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoB5F"}

package/dist/transports/oci/docker-credentials.js

@@ -0,0 +1,75 @@
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import * as path from "node:path";
+import { hostEnv } from "../../host-env.js";
+/** Path to `config.json`, honouring `DOCKER_CONFIG`. */
+function dockerConfigPath() {
+    const override = hostEnv().DOCKER_CONFIG;
+    const dir = override && override.trim() ? override.trim() : path.join(homedir(), ".docker");
+    return path.join(dir, "config.json");
+}
+async function readDockerConfig() {
+    try {
+        return JSON.parse(await readFile(dockerConfigPath(), "utf-8"));
+    }
+    catch {
+        return null; // no config, unreadable, or malformed → anonymous
+    }
+}
+/** Run `docker-credential-<helper> get` with `host` on stdin, per the Docker
+ *  credential-helper protocol, returning `{Username, Secret}` or null. */
+function runCredentialHelper(helper, host) {
+    return new Promise((resolve) => {
+        const proc = spawn(`docker-credential-${helper}`, ["get"], {
+            stdio: ["pipe", "pipe", "ignore"],
+        });
+        let out = "";
+        proc.stdout.on("data", (c) => (out += c));
+        proc.on("error", () => resolve(null)); // helper binary not installed
+        proc.on("close", (code) => {
+            if (code !== 0)
+                return resolve(null);
+            try {
+                const parsed = JSON.parse(out);
+                if (parsed.Username && parsed.Secret) {
+                    resolve({ username: parsed.Username, password: parsed.Secret });
+                }
+                else {
+                    resolve(null);
+                }
+            }
+            catch {
+                resolve(null);
+            }
+        });
+        proc.stdin.end(host);
+    });
+}
+/** Resolve credentials for `host` from the ambient Docker credential chain:
+ *  a per-registry credential helper, the global credential store, then the
+ *  inline `auths` entry (base64 `user:password` or explicit fields). Returns
+ *  null for anonymous access — the caller falls back to an anonymous token. */
+export async function resolveDockerCredential(host) {
+    const config = await readDockerConfig();
+    if (!config)
+        return null;
+    const helper = config.credHelpers?.[host];
+    if (helper)
+        return runCredentialHelper(helper, host);
+    if (config.credsStore)
+        return runCredentialHelper(config.credsStore, host);
+    const entry = config.auths?.[host];
+    if (entry?.auth) {
+        const decoded = Buffer.from(entry.auth, "base64").toString("utf-8");
+        const colon = decoded.indexOf(":");
+        if (colon > 0) {
+            return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };
+        }
+    }
+    if (entry?.username && entry?.password) {
+        return { username: entry.username, password: entry.password };
+    }
+    return null;
+}
+//# sourceMappingURL=docker-credentials.js.map

package/dist/transports/oci/docker-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-credentials.js","sourceRoot":"","sources":["../../../src/transports/oci/docker-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAa5C,wDAAwD;AACxD,SAAS,gBAAgB;IACvB,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,aAAa,CAAC;IACzC,MAAM,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,EAAE,OAAO,CAAC,CAAiB,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,kDAAkD;IACjE,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,SAAS,mBAAmB,CAAC,MAAc,EAAE,IAAY;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,qBAAqB,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE;YACzD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,8BAA8B;QACrE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2C,CAAC;gBACzE,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBACrC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;+EAG+E;AAC/E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE3E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IACD,IAAI,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/transports/oci/oci-client.d.ts

@@ -0,0 +1,51 @@
+export declare const TELO_LAYER_MEDIA_TYPE = "application/vnd.telo.module.v1+tar";
+export declare const OCI_MANIFEST_MEDIA_TYPE = "application/vnd.oci.image.manifest.v1+json";
+export declare const OCI_EMPTY_CONFIG_MEDIA_TYPE = "application/vnd.oci.empty.v1+json";
+export interface OciDescriptor {
+    mediaType: string;
+    digest: string;
+    size: number;
+    data?: string;
+    artifactType?: string;
+}
+export interface OciManifest {
+    schemaVersion: number;
+    mediaType?: string;
+    artifactType?: string;
+    config: OciDescriptor;
+    layers: OciDescriptor[];
+}
+/**
+ * A minimal OCI distribution (registry v2) client — exactly the surface Telo
+ * needs: pull manifest / pull blob / push blob / push manifest / list tags,
+ * with the `WWW-Authenticate` bearer-token handshake and the ambient Docker
+ * credential chain. Hand-rolled rather than depending on a stale/Deno-only
+ * client (see plan Decisions). One instance per `(host, repo)`; tokens are
+ * cached per scope for the instance's lifetime.
+ */
+export declare class OciClient {
+    private readonly host;
+    private readonly repo;
+    private readonly tokenByScope;
+    constructor(host: string, repo: string);
+    private base;
+    private pullScope;
+    private pushScope;
+    /** Fetch with the bearer-token dance: try (cached token if any), and on 401
+     *  resolve a token from the `WWW-Authenticate` challenge and retry once. */
+    private authedFetch;
+    /** Exchange a bearer challenge for a token, authenticating to the token
+     *  service with Docker credentials when available (else anonymous). */
+    private fetchToken;
+    pullManifest(reference: string): Promise<OciManifest>;
+    pullBlob(digest: string): Promise<Buffer>;
+    listTags(): Promise<string[]>;
+    /** Upload `bytes` as a blob (skipped when already present), returning its
+     *  `sha256:<hex>` digest. Two-step upload: obtain a session, then PUT with
+     *  the digest. */
+    pushBlob(bytes: Uint8Array): Promise<string>;
+    pushManifest(reference: string, manifest: OciManifest): Promise<void>;
+    /** Push the standard empty config blob and return its descriptor. */
+    pushEmptyConfig(): Promise<OciDescriptor>;
+}
+//# sourceMappingURL=oci-client.d.ts.map

package/dist/transports/oci/oci-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-client.d.ts","sourceRoot":"","sources":["../../../src/transports/oci/oci-client.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,qBAAqB,uCAAuC,CAAC;AAC1E,eAAO,MAAM,uBAAuB,+CAA+C,CAAC;AACpF,eAAO,MAAM,2BAA2B,sCAAsC,CAAC;AAa/E,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAgBD;;;;;;;GAOG;AACH,qBAAa,SAAS;IAIlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;gBAGvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;IAG/B,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;IAIjB;gFAC4E;YAC9D,WAAW;IAyBzB;2EACuE;YACzD,UAAU;IAmBlB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAcrD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzC,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAYnC;;sBAEkB;IACZ,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IA+C5C,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAe3E,qEAAqE;IAC/D,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC;CAShD"}

package/dist/transports/oci/oci-client.js

@@ -0,0 +1,170 @@
+import { createHash } from "node:crypto";
+import { resolveDockerCredential } from "./docker-credentials.js";
+export const TELO_LAYER_MEDIA_TYPE = "application/vnd.telo.module.v1+tar";
+export const OCI_MANIFEST_MEDIA_TYPE = "application/vnd.oci.image.manifest.v1+json";
+export const OCI_EMPTY_CONFIG_MEDIA_TYPE = "application/vnd.oci.empty.v1+json";
+/** The standard OCI empty descriptor — config `{}` (2 bytes). */
+const EMPTY_CONFIG = Buffer.from("{}", "utf-8");
+const EMPTY_CONFIG_DIGEST = "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a";
+const MANIFEST_ACCEPT = [
+    OCI_MANIFEST_MEDIA_TYPE,
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.docker.distribution.manifest.v2+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+].join(", ");
+function sha256Hex(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/** Parse a `WWW-Authenticate: Bearer realm="...",service="...",scope="..."` header. */
+function parseBearerChallenge(header) {
+    const out = {};
+    const params = header.replace(/^Bearer\s+/i, "");
+    for (const m of params.matchAll(/([a-z]+)="([^"]*)"/gi)) {
+        out[m[1].toLowerCase()] = m[2];
+    }
+    return out;
+}
+/**
+ * A minimal OCI distribution (registry v2) client — exactly the surface Telo
+ * needs: pull manifest / pull blob / push blob / push manifest / list tags,
+ * with the `WWW-Authenticate` bearer-token handshake and the ambient Docker
+ * credential chain. Hand-rolled rather than depending on a stale/Deno-only
+ * client (see plan Decisions). One instance per `(host, repo)`; tokens are
+ * cached per scope for the instance's lifetime.
+ */
+export class OciClient {
+    constructor(host, repo) {
+        this.host = host;
+        this.repo = repo;
+        this.tokenByScope = new Map();
+    }
+    base() {
+        return `https://${this.host}/v2/${this.repo}`;
+    }
+    pullScope() {
+        return `repository:${this.repo}:pull`;
+    }
+    pushScope() {
+        return `repository:${this.repo}:pull,push`;
+    }
+    /** Fetch with the bearer-token dance: try (cached token if any), and on 401
+     *  resolve a token from the `WWW-Authenticate` challenge and retry once. */
+    async authedFetch(url, init, scope) {
+        const withToken = (token) => {
+            const headers = new Headers(init.headers);
+            if (token)
+                headers.set("authorization", `Bearer ${token}`);
+            return { ...init, headers };
+        };
+        const cached = this.tokenByScope.get(scope);
+        let res = await fetch(url, withToken(cached));
+        if (res.status !== 401)
+            return res;
+        const challenge = res.headers.get("www-authenticate");
+        if (!challenge)
+            return res;
+        const token = await this.fetchToken(challenge, scope);
+        if (!token)
+            return res;
+        this.tokenByScope.set(scope, token);
+        // Drain the 401 body so the connection can be reused.
+        await res.text().catch(() => { });
+        return fetch(url, withToken(token));
+    }
+    /** Exchange a bearer challenge for a token, authenticating to the token
+     *  service with Docker credentials when available (else anonymous). */
+    async fetchToken(challenge, scope) {
+        const params = parseBearerChallenge(challenge);
+        if (!params.realm)
+            return null;
+        const tokenUrl = new URL(params.realm);
+        if (params.service)
+            tokenUrl.searchParams.set("service", params.service);
+        tokenUrl.searchParams.set("scope", params.scope || scope);
+        const headers = new Headers();
+        const cred = await resolveDockerCredential(this.host);
+        if (cred) {
+            const basic = Buffer.from(`${cred.username}:${cred.password}`).toString("base64");
+            headers.set("authorization", `Basic ${basic}`);
+        }
+        const res = await fetch(tokenUrl.href, { headers });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        return body.token ?? body.access_token ?? null;
+    }
+    async pullManifest(reference) {
+        const res = await this.authedFetch(`${this.base()}/manifests/${reference}`, { headers: { accept: MANIFEST_ACCEPT } }, this.pullScope());
+        if (!res.ok) {
+            throw new Error(`OCI pull manifest ${this.repo}:${reference} on ${this.host} failed: ${res.status} ${res.statusText}`);
+        }
+        return (await res.json());
+    }
+    async pullBlob(digest) {
+        const res = await this.authedFetch(`${this.base()}/blobs/${digest}`, {}, this.pullScope());
+        if (!res.ok) {
+            throw new Error(`OCI pull blob ${digest} from ${this.repo} on ${this.host} failed: ${res.status} ${res.statusText}`);
+        }
+        return Buffer.from(await res.arrayBuffer());
+    }
+    async listTags() {
+        const res = await this.authedFetch(`${this.base()}/tags/list`, {}, this.pullScope());
+        if (res.status === 404)
+            return [];
+        if (!res.ok) {
+            throw new Error(`OCI list tags for ${this.repo} on ${this.host} failed: ${res.status} ${res.statusText}`);
+        }
+        const body = (await res.json());
+        return Array.isArray(body.tags) ? body.tags : [];
+    }
+    /** Upload `bytes` as a blob (skipped when already present), returning its
+     *  `sha256:<hex>` digest. Two-step upload: obtain a session, then PUT with
+     *  the digest. */
+    async pushBlob(bytes) {
+        const digest = `sha256:${sha256Hex(bytes)}`;
+        const head = await this.authedFetch(`${this.base()}/blobs/${digest}`, { method: "HEAD" }, this.pushScope());
+        if (head.ok)
+            return digest; // already present
+        await head.text().catch(() => { });
+        const start = await this.authedFetch(`${this.base()}/blobs/uploads/`, { method: "POST" }, this.pushScope());
+        if (start.status !== 202) {
+            throw new Error(`OCI blob upload start for ${this.repo} on ${this.host} failed: ${start.status} ${start.statusText}`);
+        }
+        const location = start.headers.get("location");
+        await start.text().catch(() => { });
+        if (!location) {
+            throw new Error(`OCI blob upload for ${this.repo} returned no Location header`);
+        }
+        const uploadUrl = new URL(location, `https://${this.host}`);
+        uploadUrl.searchParams.set("digest", digest);
+        const put = await this.authedFetch(uploadUrl.href, {
+            method: "PUT",
+            headers: { "content-type": "application/octet-stream" },
+            body: bytes,
+        }, this.pushScope());
+        if (put.status !== 201) {
+            const detail = await put.text().catch(() => "");
+            throw new Error(`OCI blob PUT for ${this.repo} on ${this.host} failed: ${put.status} ${put.statusText} ${detail}`);
+        }
+        return digest;
+    }
+    async pushManifest(reference, manifest) {
+        const body = Buffer.from(JSON.stringify(manifest), "utf-8");
+        const res = await this.authedFetch(`${this.base()}/manifests/${reference}`, { method: "PUT", headers: { "content-type": OCI_MANIFEST_MEDIA_TYPE }, body }, this.pushScope());
+        if (res.status !== 201) {
+            const detail = await res.text().catch(() => "");
+            throw new Error(`OCI push manifest ${this.repo}:${reference} on ${this.host} failed: ${res.status} ${res.statusText} ${detail}`);
+        }
+    }
+    /** Push the standard empty config blob and return its descriptor. */
+    async pushEmptyConfig() {
+        await this.pushBlob(EMPTY_CONFIG);
+        return {
+            mediaType: OCI_EMPTY_CONFIG_MEDIA_TYPE,
+            digest: EMPTY_CONFIG_DIGEST,
+            size: EMPTY_CONFIG.length,
+            data: EMPTY_CONFIG.toString("base64"),
+        };
+    }
+}
+//# sourceMappingURL=oci-client.js.map

package/dist/transports/oci/oci-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-client.js","sourceRoot":"","sources":["../../../src/transports/oci/oci-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,4CAA4C,CAAC;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AAE/E,iEAAiE;AACjE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChD,MAAM,mBAAmB,GAAG,yEAAyE,CAAC;AAEtG,MAAM,eAAe,GAAG;IACtB,uBAAuB;IACvB,yCAAyC;IACzC,sDAAsD;IACtD,2DAA2D;CAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAkBb,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,SAAS;IAGpB,YACmB,IAAY,EACZ,IAAY;QADZ,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAQ;QAJd,iBAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAKvD,CAAC;IAEI,IAAI;QACV,OAAO,WAAW,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAEO,SAAS;QACf,OAAO,cAAc,IAAI,CAAC,IAAI,OAAO,CAAC;IACxC,CAAC;IAEO,SAAS;QACf,OAAO,cAAc,IAAI,CAAC,IAAI,YAAY,CAAC;IAC7C,CAAC;IAED;gFAC4E;IACpE,KAAK,CAAC,WAAW,CACvB,GAAW,EACX,IAAiB,EACjB,KAAa;QAEb,MAAM,SAAS,GAAG,CAAC,KAAc,EAAe,EAAE;YAChD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAC3D,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;QAC9B,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC;QAEnC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,GAAG,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,sDAAsD;QACtD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;2EACuE;IAC/D,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,KAAa;QACvD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,OAAO;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC7E,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAChC,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,SAAS,EAAE,EACvC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EACxC,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,IAAI,IAAI,SAAS,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACtG,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,SAAS,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACpG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;QAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAED;;sBAEkB;IAClB,KAAK,CAAC,QAAQ,CAAC,KAAiB;QAC9B,MAAM,MAAM,GAAG,UAAU,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAE5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CACjC,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAChC,EAAE,MAAM,EAAE,MAAM,EAAE,EAClB,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,kBAAkB;QAC9C,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAElC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAClC,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAC/B,EAAE,MAAM,EAAE,MAAM,EAAE,EAClB,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,YAAY,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,IAAI,8BAA8B,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAChC,SAAS,CAAC,IAAI,EACd;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACvD,IAAI,EAAE,KAAK;SACZ,EACD,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,MAAM,EAAE,CAClG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,QAAqB;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAChC,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,SAAS,EAAE,EACvC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,EAC7E,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,IAAI,IAAI,SAAS,OAAO,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,MAAM,EAAE,CAChH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAClC,OAAO;YACL,SAAS,EAAE,2BAA2B;YACtC,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,YAAY,CAAC,MAAM;YACzB,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACtC,CAAC;IACJ,CAAC;CACF"}

package/dist/transports/oci/oci-ref.d.ts

@@ -0,0 +1,21 @@
+export declare const OCI_SCHEME = "oci://";
+/** A parsed `oci://host/repo@reference` module ref.
+ *
+ *  - `host` — the registry host (`ghcr.io`, `123.dkr.ecr.us-east-1.amazonaws.com`).
+ *  - `repo` — the repository path (`aws/telo-s3`), possibly multi-segment.
+ *  - `reference` — a tag (`1.2.0`) or a digest (`sha256:...`); the OCI address.
+ *  - `integrity` — Telo's inline `sha256-<base64url>` hash when the ref is pinned
+ *    (authoritative across transports; the OCI digest is only corroborating). */
+export interface ParsedOciRef {
+    host: string;
+    repo: string;
+    reference: string;
+    integrity?: string;
+}
+/** True when `ref` uses the `oci://` scheme (integrity fragment tolerated). */
+export declare function isOciRef(ref: string): boolean;
+/** Parse `oci://host/repo@reference[#sha256-...]`. Throws on a malformed ref.
+ *  A `reference` may be a tag or a `sha256:` digest; when absent (`@` omitted)
+ *  it defaults to `latest`, matching OCI tooling. */
+export declare function parseOciRef(ref: string): ParsedOciRef;
+//# sourceMappingURL=oci-ref.d.ts.map

package/dist/transports/oci/oci-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-ref.d.ts","sourceRoot":"","sources":["../../../src/transports/oci/oci-ref.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC;;;;;;iFAMiF;AACjF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;qDAEqD;AACrD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CA0BrD"}

package/dist/transports/oci/oci-ref.js

@@ -0,0 +1,36 @@
+import { splitIntegrity } from "@telorun/analyzer";
+export const OCI_SCHEME = "oci://";
+/** True when `ref` uses the `oci://` scheme (integrity fragment tolerated). */
+export function isOciRef(ref) {
+    return splitIntegrity(ref).base.startsWith(OCI_SCHEME);
+}
+/** Parse `oci://host/repo@reference[#sha256-...]`. Throws on a malformed ref.
+ *  A `reference` may be a tag or a `sha256:` digest; when absent (`@` omitted)
+ *  it defaults to `latest`, matching OCI tooling. */
+export function parseOciRef(ref) {
+    const { base, integrity } = splitIntegrity(ref);
+    if (!base.startsWith(OCI_SCHEME)) {
+        throw new Error(`Invalid OCI reference '${ref}', expected oci://host/repo@reference`);
+    }
+    const rest = base.slice(OCI_SCHEME.length);
+    const slash = rest.indexOf("/");
+    if (slash <= 0) {
+        throw new Error(`Invalid OCI reference '${ref}', missing repository path after host`);
+    }
+    const host = rest.slice(0, slash);
+    let repoAndRef = rest.slice(slash + 1);
+    let reference = "latest";
+    const at = repoAndRef.lastIndexOf("@");
+    // A digest reference is `repo@sha256:...` — the `@` before `sha256:` is the
+    // separator, not part of the repo. A tag reference has no `@`.
+    if (at > 0) {
+        reference = repoAndRef.slice(at + 1);
+        repoAndRef = repoAndRef.slice(0, at);
+    }
+    const repo = repoAndRef;
+    if (!host || !repo || !reference) {
+        throw new Error(`Invalid OCI reference '${ref}', expected oci://host/repo@reference`);
+    }
+    return { host, repo, reference, integrity };
+}
+//# sourceMappingURL=oci-ref.js.map

package/dist/transports/oci/oci-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-ref.js","sourceRoot":"","sources":["../../../src/transports/oci/oci-ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAgBnC,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACzD,CAAC;AAED;;qDAEqD;AACrD,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,uCAAuC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,uCAAuC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEvC,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QACX,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACrC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,uCAAuC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC"}

package/dist/transports/oci/oci-transport.d.ts

@@ -0,0 +1,29 @@
+import { type ManifestSource } from "@telorun/analyzer";
+import type { FetchedArtifact, PublishBundle, PublishOptions, PublishResult, SiblingIdentity, Transport } from "../transport.js";
+/**
+ * OCI transport: `oci://host/repo@reference` modules on any OCI distribution
+ * registry (GHCR / ECR / Docker Hub / Harbor), over a hand-rolled minimal
+ * client. A module is a single artifact — one tar blob carrying `telo.yaml`
+ * and the `files:` payload — pushed under a standard OCI artifact manifest.
+ *
+ * Not browser-reachable (token handshake, Docker credentials, tar extraction),
+ * so its resolution `source` is Node-only; the editor resolves `oci://` imports
+ * through the discovery hub instead.
+ */
+export declare class OciTransport implements Transport {
+    readonly source: ManifestSource;
+    constructor();
+    supports(ref: string): boolean;
+    cacheLocation(ref: string): string[] | null;
+    /** Resolve a relative import against an `oci://` base, normalizing the repo to
+     *  a directory base so `../lib` under `oci://ghcr.io/aws/my-app` →
+     *  `oci://ghcr.io/aws/lib` (never `oci://ghcr.io/lib`). Non-relative refs pass
+     *  through. The reference/tag is dropped — the caller re-pins from the
+     *  sibling's own version. */
+    resolveRelative(base: string, relative: string): string;
+    listVersions(ref: string): Promise<string[] | null>;
+    fetchArtifact(ref: string): Promise<FetchedArtifact>;
+    publish(destination: string, bundle: PublishBundle, _opts?: PublishOptions): Promise<PublishResult>;
+    canonicalizeSiblingRef(destination: string, relativeSource: string, sibling: SiblingIdentity): string;
+}
+//# sourceMappingURL=oci-transport.d.ts.map

package/dist/transports/oci/oci-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-transport.d.ts","sourceRoot":"","sources":["../../../src/transports/oci/oci-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,KAAK,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,aAAa,EACb,eAAe,EACf,SAAS,EACV,MAAM,iBAAiB,CAAC;AAmDzB;;;;;;;;;GASG;AACH,qBAAa,YAAa,YAAW,SAAS;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;;IAchC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI9B,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IAU3C;;;;iCAI6B;IAC7B,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IASjD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAMnD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIpD,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,EACrB,KAAK,GAAE,cAAmB,GACzB,OAAO,CAAC,aAAa,CAAC;IA+CzB,sBAAsB,CACpB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,eAAe,GACvB,MAAM;CAKV"}